louislam/dockge · error · Error

Invalid new password

Error message

Invalid new password

What it means

In the 'changePassword' socket handler, before any strength check, the payload's newPassword field is verified to be present and truthy. An empty, null, or undefined newPassword means nothing to change, so 'Invalid new password' is thrown and returned via the callback.

Source

Thrown at backend/socket-handlers/main-socket-handler.ts:215

                log.warn("auth", `Incorrect username or password for user ${data.username}. IP=${clientIP}`);

                callback({
                    ok: false,
                    msg: "authIncorrectCreds",
                    msgi18n: true,
                });
            }

        });

        // Change Password
        socket.on("changePassword", async (password, callback) => {
            try {
                checkLogin(socket);

                if (! password.newPassword) {
                    throw new Error("Invalid new password");
                }

                if (passwordStrength(password.newPassword).value === "Too weak") {
                    throw new Error("Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.");
                }

                let user = await doubleCheckPassword(socket, password.currentPassword);
                await user.resetPassword(password.newPassword);

                server.disconnectAllSocketClients(user.id, socket.id);

                callback({
                    ok: true,
                    msg: "Password has been updated successfully.",
                });

            } catch (e) {
                if (e instanceof Error) {

View on GitHub (pinned to f809ae192b)

Solutions

1. Include a non-empty newPassword string in the changePassword payload.
2. Validate the form field is filled before emitting the event.
3. Ensure the payload property is named exactly newPassword.

Example fix

// before
socket.emit('changePassword', { currentPassword: 'old1' }, cb);
// after
socket.emit('changePassword', { currentPassword: 'old1', newPassword: 'newpass1' }, cb);

function canSubmitPasswordChange(p) {
    return !!p && typeof p.currentPassword === 'string' && typeof p.newPassword === 'string' && p.newPassword.length > 0;
}

function hasNewPassword(p) { return typeof p?.newPassword === 'string' && p.newPassword.length > 0; }

socket.emit('changePassword', payload, (res) => {
    if (!res.ok && /Invalid new password/.test(res.msg || '')) {
        highlightNewPasswordField();
    }
});

When it happens

Trigger: Emitting 'changePassword' with an object lacking newPassword, e.g. { currentPassword: 'old1' } or { currentPassword: 'old1', newPassword: '' }.

Common situations: Frontend form submitted with blank new-password field; API scripts sending only the current password; field-name mismatches (e.g. sending new_password) so newPassword is undefined.

Understand the failure class

Background: "Missing required field" and "field is required" errors: why libraries reject payloads that omit mandatory fields — this error's family across 20 libraries.

Related errors

• Password is too weak. It should contain alphabetic and numer
• Wrong data type?
• Incorrect current password
• Name must be a string
• Stack name must be a string

AI-assisted analysis of louislam/dockge@f809ae192b (2026-08-31). Data as JSON: /api/errors/e54b7b3f33316c6f. Report an issue: GitHub.